Bridge Agent

The Bridge Agent is software on a computer at the site. It finds the cameras on the site's network and relays their video to Kalytera Cloud over an outbound, encrypted connection, so no port is opened on the site's firewall. Kalytera enables Bridge Agents on request. An administrator adds the agent and its cameras; the installer sets up the computer.

Before you start

• Computer: 64-bit Windows, or Debian or Ubuntu on 64-bit x86 (amd64). Other Linux distributions and ARM computers are not supported. The computer must stay on and reach the cameras.
• Installer: Kalytera supplies the Windows installer (MSI) and the Debian package (.deb). The portal has no download; ask through Support.
• Network: the agent listens on no port and needs these connections:

Traffic	Protocol and port	Purpose
Outbound to Kalytera	HTTPS, TCP 443	Enrollment, check-ins and settings
Outbound to Kalytera	RTMPS, to the address and port Kalytera gives the agent	Video
To the cameras	RTSP (normally 554, or 322 for RTSPS), HTTP and HTTPS	Checking and relaying streams
Discovery on the site's network	UDP 3702, 37020, 37810 and 1900	ONVIF WS-Discovery, Hikvision SADP, Dahua DHIP and Axis SSDP

If the site firewall limits outbound traffic, ask Kalytera for the domains, addresses and ports to allow. The computer's own firewall must let the discovery replies in. Discovery may not cross routed VLANs; add cameras on other networks manually.

Add the agent

1. Open Cameras > Devices and, on the Bridge Agents card, select Add Bridge Agent.
2. Enter a Name and a Description (optional), then select Create enrollment token.
3. Copy the Cloud API URL and the Enrollment token. Treat the token like a password.
4. Select I copied the enrollment token — continue. After that, the token cannot be shown again.

The token works once. Until you continue, the page can be reloaded for 15 minutes. If the token is lost before the agent enrolls, remove the pending agent and add it again.

Install the agent

The token page shows the install steps:

• Windows: install the MSI. In PowerShell run as administrator, run the enrollment command, enter the Cloud API URL if asked, then paste the token.
• Debian or Ubuntu: install the package with the command shown. The installer asks for the Cloud API URL and the token.

Under Bridge Agents, the agent's status changes from Pending enrollment to Online. To update it, install the newer package from Kalytera over the old one; the agent keeps its enrollment.

Add discovery credentials

Most cameras need a sign-in before the agent can check their stream. On the Bridge Agents page, under Discovery credentials, select Add credential. Enter a Label, the Username and Password, and optionally a Vendor (optional) and a List order. The password is encrypted and never shown again.

A credential is sent to the agent only for the one camera you verify, for one attempt. It is never tried across the network.

Find and add cameras

1. On the agent, select Discover cameras, then Scan network. The agent scans at its next check-in, usually within a minute.
2. For each camera found, pick its discovery credential in Choose credential… and select Verify. A camera that needs no sign-in is verified without one.
3. Choose the Site for new cameras.
4. Once the stream is verified, select Add camera. Without a Site, use Add disabled for later.

For a camera the scan does not find, use Add a camera manually with its address, port, stream path and sign-in.

What the agent relays

The agent relays each camera's H.264 main stream unchanged, without audio. Discovery offers only H.264 streams, so set the camera's main stream to H.264 to relay it at full quality.

Analytics rules cannot run on Bridge cameras. Motion / object detection recording needs agent version 1.5.0 or later, which detects motion on site.

Site I/O through a Bridge

Kalytera also enables Site I/O control on request. A Bridge Agent can then reach supported Axis inputs, outputs and speakers on the site's network; speaker audio works only through a Bridge. An administrator with the Configure site-control devices and Cloud arming policies permission adds each device under the site's I/O devices > Device settings and setup > Add a device, choosing the Bridge option under Connection and the Enrolled Bridge. See Cloud arming and site controls.

When the agent goes offline

• The agent shows Offline after two minutes without a check-in. That alone raises no alarm.
• Its cameras go Offline. The agent stores no video, so Kalytera Cloud has no footage for that time.
• After about a minute without video, each camera raises a Video unavailable alarm with the cause Relay video path interrupted, if Create local video availability alarms is on in Settings > Alarms.
• When the connection returns, the agent reconnects and relaying resumes by itself. A Site I/O input that changed meanwhile is reported at the first good reading.

Remove an agent

First retire the agent's Site I/O devices in Site controls. Then, on the agent, open Remove Bridge Agent and select Review and remove. Removal revokes the agent at once; its cameras are disabled and kept with their footage. Uninstall it from the computer afterwards. If an offline agent with Site I/O devices is lost or stolen, use Revoke its key on the same page first.